PlzNavigate: Enforce 'frame-src' CSP on the browser.

content/common/content_security_policy/csp_policy.cc

Index: content/common/content_security_policy/csp_policy.cc
diff --git a/content/common/content_security_policy/csp_policy.cc b/content/common/content_security_policy/csp_policy.cc
index 0abbd3437381ebf0b6ac53beed7e2a9394efab68..38abdae007f3ca8c0b2a3c6f848926d137456e5e 100644
--- a/content/common/content_security_policy/csp_policy.cc
+++ b/content/common/content_security_policy/csp_policy.cc
@@ -104,7 +104,7 @@ bool CSPPolicy::AllowDirective(CSPContext* context,
   if (directive.source_list.Allow(context, url, is_redirect))
     return true;
 
-  ReportViolation(context, directive_name, directive, url);
+  ReportViolation(context, directive_name, directive, url, is_redirect);
 
   return disposition == blink::WebContentSecurityPolicyTypeReport;
 }
@@ -112,7 +112,8 @@ bool CSPPolicy::AllowDirective(CSPContext* context,
 void CSPPolicy::ReportViolation(CSPContext* context,
                                 const CSPDirective::Name directive_name,
                                 const CSPDirective& directive,
-                                const GURL& url) const {
+                                const GURL& url,
+                                bool is_redirect) const {
   // We should never have a violation against `child-src` or `default-src`
   // directly; the effective directive should always be one of the explicit
   // fetch directives.
@@ -143,12 +144,13 @@ void CSPPolicy::ReportViolation(CSPContext* context,
   message << "\n";
 
   context->LogToConsole(message.str());
-  context->ReportViolation(CSPDirective::NameToString(directive.name),
-                           CSPDirective::NameToString(directive_name),
-                           message.str(), url, report_endpoints,
-                           // TODO(arthursonzogni): consider passing the
-                           // original header
-                           "", disposition);
+  context->ReportViolation(
+      CSPViolationParams(CSPDirective::NameToString(directive.name),
+                         CSPDirective::NameToString(directive_name),
+                         message.str(), url, report_endpoints,
+                         // TODO(arthursonzogni): consider passing the
+                         // original header

[nasko, 2017/02/15 21:28:44]

This struct now defines a member for the original header. Is this intentionally
still left blank?

[arthursonzogni, 2017/02/16 17:32:41]

I don't understand your question.

Maybe I will have to store the raw policy header inside the
CSPPolicy/ContentSecurityPolicy object. I will work on it.

+                         "", disposition, is_redirect));
 }
 
 }  // namespace content